CVE-2026-97311

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role fail to properly verify individual group visibility permissions. This allows a delegated administrator with basic search privileges to bypass security restrictions and view detailed information about all groups assigned to a role.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.